Found while fuzzing with FTFuzzer with ASan build.
Commit 01658be6fbda2ff17616158ae5df5dc240a4347c

==4440==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000009300 at pc 0x0000005df312 bp 0x7fff98c6eb30 sp 0x7fff98c6eb28
WRITE of size 8 at 0x617000009300 thread T0
    #0 0x5df311 in cff_parser_run src/cff/cffparse.c:1430:22
    #1 0x5fe7d6 in cff_subfont_load src/cff/cffload.c:1986:15
    #2 0x59319b in cff_font_load src/cff/cffload.c:2202:13
    #3 0x59319b in cff_face_init src/cff/cffobjs.c:593
    #4 0x502640 in open_face src/base/ftobjs.c:1180:15
    #5 0x500116 in FT_Open_Face src/base/ftobjs.c:2195:19
    #6 0x501fe5 in FT_New_Memory_Face src/base/ftobjs.c:1270:12
    #7 0x4ed6f0 in LLVMFuzzerTestOneInput src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:149:14
    #8 0x4ee5bd in main src/tools/ftfuzzer/../../../src/tools/ftfuzzer/ftfuzzer.cc:241:9
    #9 0x7f17d0af482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x418f98 in _start (/home/ubuntu/build/build/ftfuzzer+0x418f98)

0x617000009300 is located 0 bytes to the right of 768-byte region [0x617000009000,0x617000009300)
allocated by thread T0 here:
    #0 0x4b90c8 in __interceptor_malloc (/home/ubuntu/build/build/ftfuzzer+0x4b90c8)
    #1 0x52d607 in ft_mem_qalloc src/base/ftutil.c:76:15
    #2 0x52d607 in ft_mem_alloc src/base/ftutil.c:55
    #3 0x52d607 in ft_mem_qrealloc src/base/ftutil.c:146
    #4 0x5fe27c in cff_parser_init src/cff/cffparse.c:65:10
    #5 0x5fe27c in cff_subfont_load src/cff/cffload.c:1931
    #6 0x59319b in cff_font_load src/cff/cffload.c:2202:13
    #7 0x59319b in cff_face_init src/cff/cffobjs.c:593
    #8 0x502640 in open_face src/base/ftobjs.c:1180:15

SUMMARY: AddressSanitizer: heap-buffer-overflow src/cff/cffparse.c:1430:22 in cff_parser_run
Shadow bytes around the buggy address:
  0x0c2e7fff9210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fff9250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fff9260:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fff9270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff9280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff9290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff92a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fff92b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4440==ABORTING